Query Wizard and Query Filter Bar (Devices)
  • 9 Minutes To Read
  • Print
  • Share
  • Dark

Query Wizard and Query Filter Bar (Devices)

  • Print
  • Share
  • Dark

The Axonius Query Wizard lets customers create granular queries to understand how devices and users adhere to their policies.

Working with the Query Wizard

From the Devices screen, you can click Query Wizard on the top right corner above the Devices table to open the popup dialog to define multiple filters. Defining filters in the Query Wizard allows you to easily drill down to the assets that match the required search criteria.

Here is an example of using the Query Wizard to show only Windows device assets that have been seen in the last 7 days using filters where the value of the common field OS: Type equals Windows and the value of the common field Last Seen is within the last 7 days.


Each row in the Query Wizard is a filter expression that consists of the following elements:

  1. AND / OR switch
  2. NOT Flag
  3. Source drop-down
  4. Adapter drop-down
  5. Field drop-down
  6. Operator drop-down
  7. Value field
  8. Bracket controls

1. AND / OR Switch

This switch is only shown on the second and subsequent filter rows. When you have more than one filter defined, this allows you to control whether all filters are required to match, or if just one filter can match.

2. NOT Flag

This flag allows you to negate the filter line, and only match assets that do NOT match the adapter, field, operator, and value specified.

For example:
means that Axonius will return all devices EXCEPT the devices where the OS type is Windows (including devices where the OS type is unknown or this field doesn’t apply, and not just devices that their OS type is defined and NOT Windows).

3. Source Drop-Down

The source drop-down contains the following options:

  • Aggregated Data (displayed as ALL)
    • This option lets you query on all assets common fields fetched from any of the adapter connections.
    • This option is selected by default.
  • Complex Field (displayed as OBJ)
    • This option lets you query on assets with a specific complex field that meets the specified criteria.
      • Example: query on all devices that have installed software that meets the following criteria:
        • Installed Software:Software Name contains 'chrome'.
        • Installed Software:Software Version NOT later than 86.


  • Asset Entity (displayed as ENT)
    • This option lets you query on a specific asset entity, meaning, a device or a user entity fetched from a specific adapter connection.
    • This option is useful if assets in your Axonius environment have been correlated by several different asset entities from the same adapter connection, for example: Amazon Web Services (AWS), Microsoft Azure Active Directory (Azure AD), SolarWinds Network Performance Monitor and Tanium.
      • Example 1: query on all devices that were fetched from Microsoft Azure Active Directory (Azure AD) (but not from Microsoft Intune, which is also part of this adapter) and are managed by Azure AD.
      • Example 2: query on all users that were fetched from Amazon Web Services (AWS) with a specific Adapter Connection Label and the Device Type is EC2.


  • Field Comparison (displayed as CMP)
    • This option lets you compare between adapter field values, and only return devices which match the comparison.
    • The following field types are supported: String, Enum, Boolean, Numeric and Date.
    • For String, Enum, Boolean, and Numeric fields - Equals operand is supported (String comparison is case-sensitive)
    • For Date fields - Equals, <, >, <days and >days operands are supported.
    • When comparing date fields, the time is ignored and only the date is compared.
    • The new >days operand lets you query if the first date field is later than the second date field by more than the number of days specified.
    • The new <days operand lets you query if the first date field is sooner than the second date field by more than the number of days specified.
    • Example: query all devices whose last seen by the Amazon Web Services (AWS) adapter is more than 3 days after their last seen by the Microsoft Active Directory (AD) adapter.


4. Adapter Drop-Down

This drop-down contains a list of all adapters that have fetched data for assets. The adapter that is selected in this drop-down controls the list of fields displayed in the Field drop-down. You can quickly search for adapters using the search bar at the top of this drop-down.

The first entry and default selection in this drop-down is Aggregated represented with the image.png icon. All of the fields for Aggregated are the collated values from all of the data that has been fetched for all adapters, considered as common fields.

You can control the adapter data sources that are used when evaluating a filter for a common field. By default, all adapters are selected. If you choose to only evaluate the operator and value query data in a common field from a subset.

The adapter source of a Aggregated Data / common field can be specified. If specified, the image.png icon will be replaced by image.png, to indicate that specific sources have been selected. By default, all adapter sources are queried.


5. Field Drop-Down

This drop-down contains a list of all the fields that have been fetched for a specific adapter. In the case of the Aggregated selection in the Adapter drop-down, this is a list of all fields whose data is collated from all adapters.

  1. Select the common field option (image.png icon, default option) to search any generic field. Common fields are device properties retrieved from multiple adapters.

  2. Click the Adapter drop-down list to select the device property to be queried. Use the search bar to search for a specific field name.

6. Operator Drop-Down

Once a field is selected, you need to select a comparison function from a drop-down list. For each field type there is a list of possible functions:

  • Enumerated – 'equals' function along with a selection of a values from a list of pre-defined values
  • Text – 'contains', 'equals', 'in', 'starts', 'ends' and 'regex' functions, all refer to a text value to compare to.
    • When choosing 'in', the text value should be a comma-separated list of values.
    • When choosing 'in', the comma (,) character can be escaped by using a double backslash (e.g \\,)
  • Numeric – 'equals', '>' (greater) and '<' (lesser) functions, all refer to a numeric value to compare to.
  • Date – '>' (after), '<' (before), 'last days', 'next days', 'next days from now', 'last hours', 'next hours' and 'next hours from now' functions, all refer to a date expression to compare to.
    When choosing '<' or '>' the value to compare is a chosen calendar date expression. When choosing 'last days', 'next days' and 'next days from now' the value to compare to is the relative number of days (integer). When choosing 'last hours', 'next hours' and 'next hours from now' the value to compare to is the relative number of hours (integer).
  • IP – 'size', 'exists', 'in subnet', 'not in subnet', 'contains', 'regex', 'equals', 'isIPv4' and 'isIPv6' functions, all refer to an IP address value to compare to.
  • Version - 'contains', 'equals', 'regex', 'earlier than', 'later than' functions, all refer to a version value to compare to.
The Adapter Connections field has unique actions to filter by the number of the adapters: 'count =', 'count <', 'count >'
The OS: Distribution field has unique actions to filter devices with Windows versions lower or higher than the compared version: '<', '>'
The 'exists' function can be used to filter the existence of any property value and is available for all field types.
A single query expression using the 'in' function can replace multiple query expressions using the 'equals' function with 'or' operands between them.

7. Value Field

Specify the value to be compared by the field and function. Different relevant value options will be enabled according to the field type and the operator/function chosen.


8. Parentheses Controls

When defining multiple expressions with a combination of "OR" and "AND" operands between them, usage of parentheses impacts the query definition.


In some complex expressions, multiple parentheses may be required. To increase/decrease the number of parentheses, click the up/down arrows in the Parentheses Control.

Add Field to Column / Remove Field from Column

On each row in the Query Wizard, the Add Field to Column image.png or Remove Field from Column image.png button will be present. This button is enabled once a field is selected for the expression.
This button lets you easily add or remove fields as columns in the Devices/Users table directly from the Query Wizard.
A column will be always added as the second column in the table.
The state of this button (Add or Remove) is determined by whether the field already exists as a column in the table.

Duplicate Row

On each row in the Query Wizard, the Duplicate Row button image.png will be present. When on the first row, it duplicates the entire block and on inner rows it duplicates only the selected row.

Expression Indicative Error

When an error occurs for a given expression, an indicative text referring to that error appears in red in the bottom of the Query Wizard. Use it to correct the expression.
For example, missing right bracket:


When you complete a filter expression, the contents of the Devices table is refreshed with the results of your query. When you have completed building the query expression, click "Search". The final query expression is displayed in the Query Filter Bar. Click "Clear" to clear all expressions in the wizard, which will also clear the saved query, if used, and will refresh the Devices table and display all existing devices.

You can always toggle back to the Query Wizard, change and refine the query, and create a multi-filter expression, by adding AND/OR operators between them:

  • To add a new expression, click image.png
  • To remove an expression, click image.png
  • To reorder the expressions, hover over the expression to use the drag and drop functionality image.png

For each added or removed expression the Devices table results are dynamically updated.

Advanced Querying

Free Text Search in Table

The search bar lets you search free text and filter on devices with or without a predefined 'search by' option. By typing the required search text and pressing Enter, the results filter all entities in the table that contain the given text in any properties.

The available search options are:

  • Free text search - Axonius runs the following search logic on the specified search value:
    • 'Case sensitive exact match' search in any of the selected columns.
    • 'Case insensitive exact match/ start with' search in the following columns:
      • Devices page: Hostname, Last Used Users.
      • Users page: User Name, Email.


  • Predefined 'search by' option
    • Click the search bar dropdown button or press the down arrow key to select one of the predefined 'search by' options:
      • Host Name - to run 'contains' search on 'Host Name' only.
      • Last Used Users - to run 'contains' search on 'Last Used Users'.
      • IP Address - to run 'contains' search on 'Network Interfaces: IPs'.
      • Installed Software Name - to run 'contains' search on 'Installed Software: Software Name'.
    • Each 'search by' option consists of a different set of columns, that can be personalized and saved as the user's search default view. For more details, see Editing Table Columns.



All searches are tracked and stored. Click the search bar drop-down button or press the down arrow key to browse the search History and the recent Saved Queries ran.

Using a Saved Query as a Filtering Condition in Query Wizard Expressions

You can use a saved query to create complex queries based on pre-defined queries. Only saved queries whose access is not private can be selected.


Was This Article Helpful?